What Changed runs entirely in the browser with no server component. The primary security concerns are:

1. Local data sensitivity — stored page content may include PII from pages the user visits
2. Content script injection — the content script runs on every page and must not leak data or be exploitable
3. Extension permissions — <all_urls> is a powerful permission that requires justification

• All data stored locally in IndexedDB (no network requests)
• No external API calls, analytics, or telemetry
• No remote code loading
• SHA-256 hashing uses Web Crypto API (not a custom implementation)
• Content extraction uses Mozilla's Readability.js (audited, open source)
• User can clear all data from settings page
• Automatic pruning deletes old snapshots (configurable retention)

• Content script only reads DOM, never modifies it
• No eval(), Function(), or dynamic code execution
• No innerHTML writes to the host page
• Content script communicates only via chrome.runtime.sendMessage (extension-internal)
• Login pages detected and skipped (password field heuristic)

• Diff HTML rendered via innerHTML in extension-owned pages only (not injected into host pages)
• Diff content is escaped (&, <, >) before rendering to prevent XSS from captured page content
• No user-supplied URLs used in navigation or fetch calls

• <all_urls> justified: passive capture on every page requires broad access; activeTab would require user click per page
• unlimitedStorage justified: accumulated snapshots exceed default quota
• tabs justified: needed for URL detection and badge updates
• alarms justified: daily pruning of old snapshots
• No webRequest, debugger, or other high-risk permissions

• Dependencies pinned to exact versions (no ^ or ~)
• 3 runtime dependencies: @mozilla/readability, diff, idb (all widely used, audited)
• No post-install scripts in dependencies
• Source maps included in build for CWS review transparency

• Privacy policy published and covers all data handling
• No data transmitted off-device
• No third-party integrations
• Domain blocklist allows users to exclude sensitive sites